Splunk Enterprise CVE-2026-20240

Exploitation requires a valid Splunk user account that does not hold the 'admin' or 'power' role - a standard low-privileged account (e.g., user or analyst role) is sufficient. The CVSS vector PR:L confirms authenticated but low-privilege access is required; unauthenticated exploitation is not possible. The attacker must be able to reach the Splunk instance over the network (AV:N) and invoke functionality associated with the splunk_archiver app's coldToFrozen.sh script. No special non-default configuration is described as required - the splunk_archiver app is a bundled Splunk component, meaning standard deployments are likely affected. Exploitation is limited by the requirement for a valid credential: anonymous or unauthenticated attackers cannot trigger this. The impact is confined to availability only - no data exfiltration or code execution is possible via this vector.

The CVSS 6.5 score is derived from a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating network-accessible exploitation requiring only low-level authentication with no user interaction and no elevated privileges beyond a standard Splunk account. The availability impact is rated High (A:H), reflecting that successful exploitation fully disables the Splunk instance. Confidentiality and integrity are unaffected (C:N/I:N), limiting the severity ceiling. The low attack complexity (AC:L) and absence of required user interaction increase the practical risk - any low-privileged Splunk user who does not hold the 'admin' or 'power' role can trigger this without relying on social engineering or race conditions. No EPSS score was provided in the source data, which limits quantitative exploitation probability assessment. No CISA KEV listing and no POC code are identified, suggesting no confirmed widespread exploitation at time of analysis. The realistic priority is moderate-to-high in environments with many low-privileged Splunk users, shared Splunk instances, or where Splunk is critical SIEM infrastructure - a single authenticated user could take down enterprise-wide logging and detection capabilities. The vulnerability is less acute in tightly controlled deployments where Splunk access is restricted to trusted analysts.

An attacker with a low-privileged Splunk account (e.g., a read-only analyst account without 'admin' or 'power' roles) authenticates to the Splunk web interface or REST API and triggers the coldToFrozen.sh script within the splunk_archiver app, supplying a crafted arbitrary file path pointing to a critical Splunk system directory such as the configuration or dispatch directory. The script renames the targeted directory without validation, causing Splunk to lose access to essential runtime paths and become non-functional. No public proof-of-concept code has been identified at time of analysis, but the primitive - passing a malicious path argument to an unvalidated shell script - is straightforward to construct from the public description.